SY0-701 Practice Exam 62 — 20 Questions

Question 1

A firewall rule was changed in production to allow a new vendor IP range, and payroll users immediately lost access to an internal service. Which two change-management practices would have reduced the risk of this outage? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Test the rule in a staging environment with representative traffic before production deployment.. Testing the firewall rule in a staging environment with representative traffic allows you to validate that the new vendor IP range does not inadvertently block or conflict with existing rules before impacting production. This practice catches misconfigurations—such as an overly broad permit that shadows a deny rule for payroll users—without risking service disruption. Staging mirrors production ACL logic, so you can verify that the rule order and match criteria (e.g., source IP, destination port) behave as intended.

Answer

Make the change during the busiest business hour so the team can observe the effect immediately.

Answer

Remove logging on the firewall so only the new rule is visible during troubleshooting.

Answer

Skip approval because the vendor was already known to the organization.

Question 2

Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?

Accepted Answer

DNS poisoning. DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.

Answer

Denial of service

Answer

Replay attack

Answer

Port scanning

Question 3

Field technicians use company-owned tablets that also run approved personal apps. Security needs corporate email and documents isolated from personal data, selective wipe of only business content if a device is lost, and compliance checks before access is allowed. What should be deployed?

Accepted Answer

Mobile device management with a work profile or container and conditional access.. Mobile device management (MDM) with a work profile or container (e.g., Android Work Profile or iOS Managed Open In) provides the required isolation between corporate and personal data. Conditional access enforces compliance checks (e.g., device health attestation, OS patch level) before granting access to corporate resources. This combination also enables selective wipe of only the work container without affecting personal apps or data, meeting the lost-device requirement.

Answer

Full-disk encryption on the tablets with no additional device management.

Answer

A mobile VPN client with split tunneling enabled for user convenience.

Answer

An antivirus app with a blacklist of approved and unapproved mobile apps.

Question 4

A legal department sends a confidential contract to an outside partner without first exchanging a shared secret. The sender encrypts the document with the partner's public key so that only the partner can decrypt it with the matching private key. Which cryptographic approach is being used?

Accepted Answer

Asymmetric encryption. B is correct because the scenario describes encrypting a document with the recipient's public key, which can only be decrypted by the recipient's private key. This is the defining characteristic of asymmetric encryption (also known as public-key cryptography), where two different but mathematically related keys are used for encryption and decryption.

Answer

Symmetric encryption

Answer

Hashing

Answer

Digital signatures

Question 5

A company is signing a contract with a SaaS expense platform. Security wants the vendor to notify the company within 24 hours of a confirmed incident, maintain customer data segregation, and allow the company to verify security commitments if required. Which control should be added to the agreement?

Accepted Answer

A security addendum with SLA terms. A security addendum or contract clause set is the right place to define incident notification timing, data segregation expectations, and verification rights. These requirements need to be written into a binding agreement so both sides understand their responsibilities and so the customer has leverage if the vendor does not comply. This is stronger than informal assurances or generic privacy language.

Why others are wrong: An NDA is about secrecy, not measurable security obligations. A verbal promise is not enforceable and is weak evidence for oversight or audits. Default public terms often favor the vendor and may not cover incident timing or security commitments in enough detail. The organization needs a contract mechanism that clearly states the control expectations, not just a confidentiality promise.

Answer

A non-disclosure agreement only

Answer

A verbal assurance from the account representative

Answer

The vendor's standard public terms without changes

Question 6

A manager wants files on a stolen laptop to remain unreadable even if the drive is removed and connected to another computer. Which control should be implemented?

Accepted Answer

Full-disk encryption. Full-disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all user data. When the drive is removed and connected to another computer, the encrypted data remains inaccessible without the correct decryption key or passphrase, ensuring files stay unreadable. This directly addresses the manager's requirement for data confidentiality even after physical theft.

Answer

File compression

Answer

Packet filtering

Answer

Digital signing

Question 7

A development manager wants to copy a production customer database into a test environment so testers can reproduce a bug. The database contains names, addresses, and payment tokens. What is the best security practice before the copy is made?

Accepted Answer

Mask, tokenize, or replace sensitive fields with approved test data before moving it.. Copying production data containing sensitive information (names, addresses, payment tokens) into a test environment without sanitization violates data minimization and privacy principles (e.g., GDPR, PCI DSS). The best practice is to apply data masking, tokenization, or substitution with realistic but non-sensitive test data before the copy, ensuring that the test environment does not expose real customer data. This prevents accidental data leakage and reduces compliance risk while still allowing testers to reproduce the bug with functionally equivalent data.

Answer

Copy the production database unchanged and limit access to the QA team.

Answer

Compress the database export to reduce storage and transfer time.

Answer

Encrypt the database backup and give developers the decryption key.

Question 8

A team is deploying a containerized API to a public cloud. The service must be reachable only by internal corporate applications, and secrets must not be embedded in images or readable as plaintext by administrators of the underlying host. Which two actions best fit the design? Select two.

Accepted Answer

Place the API in a private subnet and expose it only through an internal load balancer or private endpoint.. Placing the API in a private subnet and exposing it only through an internal load balancer or private endpoint ensures that the service is reachable only by internal corporate applications, as traffic never traverses the public internet. This design leverages network segmentation and private IP addressing to enforce access control at the network layer, aligning with the requirement for internal-only reachability.

Answer

Give each container a public IP and restrict access by source IP allowlist.

Answer

Bake database passwords into the container image so deployment is simpler.

Answer

Assume the cloud provider's tenant isolation alone is enough to protect secrets from misuse.

Question 9

An endpoint investigation shows winword.exe launching powershell.exe with -nop -w hidden -enc arguments. The same host also has a newly created WMI permanent event subscription, and no new executable has appeared in Downloads or Program Files. Which two findings are most consistent with a fileless compromise and persistence mechanism? Select two.

Accepted Answer

PowerShell was launched with encoded, hidden execution arguments from a document process.. The use of winword.exe to launch powershell.exe with `-nop -w hidden -enc` arguments is a classic fileless execution technique. The encoded command runs entirely in memory without writing a payload to disk, and the launch from a document process (winword.exe) indicates a macro or exploit-based initial access, consistent with a fileless compromise.

Answer

A new executable named updater.exe was copied into Program Files by an administrator.

Answer

The browser cache was cleared after a routine user sign-out.

Answer

A signed video driver updated successfully through Windows Update.

Question 10

A security manager at a hospital is reviewing the annual vendor risk assessment for a cloud-based electronic health record (EHR) provider. The provider's SOC 2 Type II report, issued six months ago, identifies a significant deficiency in logical access controls: the provider failed to revoke access for former employees in a timely manner. The provider's management has asserted that this deficiency has been fully remediated, but the next SOC 2 audit is not scheduled for another eight months. The hospital's data protection policy requires that any vendor handling protected health information (PHI) must have a current SOC 2 Type II report with no unresolved significant deficiencies. Which of the following is the most appropriate next step for the security manager?

Accepted Answer

Require the vendor to provide a bridge letter from their external auditor confirming that the remediation has been implemented and is operating effectively.. The hospital's policy requires a current SOC 2 Type II report with no unresolved significant deficiencies. Since the deficiency was reported but is claimed to be fixed, a bridge letter from the external auditor provides independent assurance that the remediation is effective and operating as intended, bridging the gap until the next formal audit. This is the most appropriate step because it maintains compliance without prematurely terminating a critical vendor relationship.

Answer

Accept the vendor's assertion that the deficiency has been remediated and continue the relationship as is.

Answer

Immediately terminate the contract with the EHR provider and begin the process of selecting a new vendor.

Answer

Increase the frequency of manual access reviews performed by the hospital's internal IT staff on the vendor's systems.

Question 11

A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?

Accepted Answer

Vishing, because the attacker is using a voice call to pressure support staff into changing access.. Vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.

Answer

Spear phishing, because the caller used specific employee details to appear credible.

Answer

Pretexting, because the attacker is creating a false identity and believable story.

Answer

Baiting, because the attacker offered a tempting opportunity tied to a customer demo.

Question 12

A security analyst in the SOC is reviewing an alert from the corporate VPN server. The alert indicates that user 'jsmith' authenticated successfully from an IP address in Brazil at 14:30 UTC. The analyst contacts jsmith, who confirms he is physically in the company's headquarters in Chicago and has not remotely accessed the VPN today. The VPN authentication logs show that jsmith's session used a valid smart card certificate for authentication. The analyst checks the certificate revocation list and finds that jsmith's certificate has not been revoked. Which of the following is the most likely explanation for this event?

Accepted Answer

The user's smart card and PIN were stolen, allowing an attacker to authenticate from Brazil.. The scenario describes a successful VPN authentication using a valid smart card certificate from a location (Brazil) that the legitimate user (jsmith) denies accessing. Since the certificate was not revoked and the smart card requires both the card and PIN for use, the most plausible explanation is that both were stolen, enabling an attacker to authenticate as jsmith. The certificate revocation list (CRL) check confirms the certificate is still valid, ruling out revocation-based defenses, and the user's physical presence in Chicago eliminates the possibility of a legitimate remote session.

Answer

An attacker performed a pass-the-hash attack using cached credentials from jsmith's workstation.

Answer

The VPN server's certificate was forged, allowing the attacker to intercept jsmith's credentials.

Answer

The user's account password was guessed through a brute-force attack and then used to create a new certificate.

Question 13

Based on the exhibit, what is the most likely issue with the software component being built?

Accepted Answer

Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.. The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Answer

Cross-site scripting, because the package name suggests the application handles web content.

Answer

Credential stuffing, because automated systems frequently reuse credentials during updates.

Answer

Replay attack, because the nightly pipeline used an old copy of the package request.

Question 14

A company moves a Linux server to infrastructure as a service (IaaS). Which task remains the customer's responsibility?

Accepted Answer

Patching the guest operating system and installed applications.. In an IaaS model, the cloud provider manages the physical infrastructure, hypervisor, and network backbone, while the customer retains responsibility for securing and maintaining the guest operating system and any installed applications. This includes applying security patches, updating software, and configuring the OS-level firewall. For a Linux server, the customer must run commands like `apt update && apt upgrade` or `yum update` to patch the OS and manage application dependencies.

Answer

Replacing failed power supplies in the data center.

Answer

Maintaining the hypervisor on the host system.

Answer

Building and securing the provider's network backbone.

Question 15

Based on the exhibit, what is the primary security concern with the current access assignments, and what concept is being violated?

Accepted Answer

The configuration violates separation of duties by letting one person prepare and approve the same payroll activity.. The exhibit shows a single user account with permissions to both prepare and approve payroll transactions. This violates the security principle of separation of duties, which requires that no single individual has control over all phases of a critical process. The primary concern is that this configuration enables fraud or error without independent oversight, as the same person could create and authorize a fraudulent payroll entry.

Answer

The system is missing multifactor authentication for payroll users.

Answer

The account should be converted to a shared group account for the finance team.

Answer

The permissions are acceptable because payroll users always need full access to related finance functions.

Question 16

An email gateway receives a macro-enabled spreadsheet from an external supplier. Signature-based scanning does not flag it, but the security team wants to observe whether it drops files, creates persistence, or contacts suspicious domains before delivery to the user. Which tool best meets this need?

Accepted Answer

Sandboxing, because it detonates the file and observes malicious behavior safely.. Sandboxing is the correct choice because it detonates the file in an isolated, controlled environment to observe its runtime behavior, such as dropping files, creating persistence mechanisms, or making outbound connections to suspicious domains. Unlike signature-based scanning, sandboxing can detect unknown or zero-day malware by analyzing behavioral indicators without risking the production network.

Answer

DLP, because it prevents any document from leaving the organization.

Answer

NAC, because it can block the supplier's laptop from the network.

Answer

A SIEM, because it can block the attachment and quarantine the message.

Question 17

A SIEM alert shows five failed logins to a SaaS admin portal from one IP, followed by a successful login from a new city three minutes later. Which two actions are the best next steps for the analyst to validate the event before containment? Select two.

Accepted Answer

Review the identity provider and MFA logs to confirm the successful login came from the same account and device context.. Reviewing the identity provider (IdP) and MFA logs allows the analyst to verify whether the successful login originated from the same user account and device context as the failed attempts. This step is critical to determine if the successful login was an attacker who bypassed MFA or a legitimate user who eventually succeeded, providing evidence of account compromise or a false positive.

Answer

Immediately disable the SaaS platform for every user until the investigation is finished.

Answer

Reimage the user’s laptop immediately to remove any possible malware.

Answer

Delete the failed login records to reduce noise in the SIEM.

Question 18

EDR alerts on a remote laptop show a suspicious process attempting to dump browser credentials and then contacting a rare domain. The user is in another time zone and still needs the laptop online for a presentation later today. What containment action is best?

Accepted Answer

Remotely isolate the device through the EDR console while keeping it powered on.. Remotely isolating the device through the EDR console is the best containment action because it immediately blocks all network communication to and from the laptop while keeping it powered on and running. This prevents the suspicious process from exfiltrating browser credentials or communicating with the rare command-and-control domain, yet allows the user to continue using local applications for the presentation later today. EDR isolation typically works by applying a host-based firewall rule that drops all traffic except to the EDR management server, ensuring the threat is contained without disrupting local productivity.

Answer

Ask the user to uninstall the EDR agent and reboot the laptop.

Answer

Wait until after the presentation and then begin containment.

Answer

Email the user asking them to close the browser and log out of their accounts.

Question 19

A company wants employees to use their normal login from managed devices but require extra verification when they sign in from an unmanaged laptop or a new location. Which two controls should the team use? Select two.

Accepted Answer

Conditional access. Conditional access (A) is correct because it allows the company to define policies that grant or block access based on conditions such as device compliance (managed vs. unmanaged) and location (trusted vs. new). Multi-factor authentication (B) is correct because it provides the extra verification step required when the conditional access policy detects an unmanaged laptop or a new location, ensuring the user proves their identity beyond just a password.

Answer

DNS filtering

Answer

Disk encryption

Answer

Port security

Question 20

An operations manager states that the customer portal may be unavailable for no more than 15 minutes in a month before the issue must be escalated to executives. Which risk management concept does this statement describe?

Accepted Answer

Risk tolerance, because it sets a specific measurable threshold for acceptable impact.. Risk tolerance defines the specific, measurable deviation from risk appetite that an organization is willing to accept. The operations manager's statement sets a precise threshold—15 minutes of unavailability per month—before escalation is required, which is a classic example of risk tolerance in IT service management.

Answer

Risk appetite, because it describes the organization’s overall willingness to take risk.

Answer

Risk transfer, because the business is moving the outage risk to another party.

Answer

Risk avoidance, because the organization is eliminating the portal risk completely.